As it turns out, compilers happily spill the index for indirect jumps through a jump table after bounds checking, creating a TOCTTOU race for arbitrary control-flow hijacking. Check out our @HexHiveEPFL@IEEESSP "WarpAttack" paper: https://t.co/hBYmGqeh0N
Building on the success of previous editions, #nohat2022 will take place in beautiful Bergamo's conference center on November 2022. Get ready to sharpen your skills and knife!
Got the root shell and escaped from the container on Google's Container-Optimized OS. Used a 1-day, but indeed a 0-day in many vendors' kernel. I will release the code if possible, it might be the first public exploit applying corss-cache technique in Linux kernel. #kctf